Hi all,
this thread is to add working REGEX that we can share with the community. To add them to this sticky, you should have the regex working in your server, this thread is not intended to solve any issues related with no working regex, the intention is to give users of CSF REGEXs that could make CSF with more security options.
If you want to collaborate, please add your rule to this thread...
If you have one particular IP address that is either dropped or accepted through the firewall that you think should not be, then you can use the new WATCH_MODE in csf.
Before enabling this option and using the CLI command to watch an IP address, check whether it is explicitly listed first using:
csf --grep 11.22.33.44
Where 11.22.33.44 is the IP address you're tracking. If that comes back...
If you get iptables errors when trying to start csf on a VPS then you most likely have missing iptables modules for your VPS.
If your hosting provider wants to know how to configure iptables correctly on a VPS server, then you should point them to this Parallels FAQ and have them follow it (plus to add ip_conntrack_ftp to the list of required modules):
I apologize, but could you still explain how it turns out that in your database - /var/lib/csf/Geo/dbip-country-lite.csv it is written like this: 130.0.232.0,130.0.239.255,UA And in the logs it came: This is what the csf shows... Table Chain num pkts bytes target prot opt in out source destination filter ALLOWIN 3 590 86236 ACCEPT tcp -- !lo * 130.0.234.147 0.0.0.0/0 tcp dpt:2829 IPSET:...
I use TMUX a lot, but lately it doesn't keep the sessions when you restart the server or if you are inactive for a long time.
I suspect it may have something to do with CSF.
Very annoying when you have configured many things.
Have to start from scratch every time.
I would like to ask if there is a feature in csf/lfd where if a user keeps running multiple queries from same IP to be banned and if I can adjust that?
I've got a website of a non profit organization with a large db and getting attacks from multiple IPs from a specific country.
I blocked the country but is a matter of time to use another country to keep going etc so this is not a...
Time: Wed May 15 19:08:50 2024 -0400
File: /tmp/alfacgiapi/getheader.alfa
Reason: Script, starts with #!
Owner: fromhigher:fromhigher (1013:1014)
Action: No action taken
I went in and found that the site was hacked, deleted everything, restored and patched from a clean backup. Also emptied the trash on that account. However, I keep getting this same email...
When my csf.allow file is empty, I can't send (SMTP) or read (POP) emails on my server, it ends up with a timeout. Adding my IP in csf.allow, everything is ok.
I would like to be able to access my emails from anywhere, how should I do ? I have looked for a parameter in csf.conf for that, but have not found so far :confused: . Any help appreciated.
I'm having difficulty with getting SMTP auth failures detected by LFD. I believe this is partially due to Postfix on Ubuntu not reporting the rhost in the /var/log/auth.log file. Here's an example:
Hello.
When I activate cfs and Fail2Ban, Fail2Ban does not send me detailed information like the one I attached in the email. When I disable cfs it sends.
VPS Server virtualmin for ubuntu 22.04
This started happening and I am not sure what I am missing at the moment. csf.deny is now cleared and I have created an /etc/csf/csf.cloudfront.allow with their full range of IPs and included reference to it in the csf.allow and restarted but I am still seeing timeouts. As soon as I turn off csf, it loads right up. I have also made sure flooding options are disabled but still encountering this...
Hello , I'm getting this message in my email from the cron daemon: Oops: Unable to download: Can't connect to download2.configserver.com:443 (Connection timed out) . now 433 is open and I don't see the cron job in the cron job area of cPanel. I've whitelisted the config server IPs too in CSF. is there a cron job script i can add to the cron job lists in cPanel? Thank you for the help! :)
I have a member on the server that uses google ads. Google is reporting http 500 error for the url's, even though they work fine. They are saying their IP(s) are being blocked. I downloaded a list of all of their IP's and CIDR's (about 300) and added them to the whitelist by editing the allow list. But the problem is still there. I found that if an IP is in the deny list and I add it to the allow...
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum